November 2008 - Security-announce

APPLE-SA-2008-11-20 iPhone OS 2.2 and iPhone OS for iPod touch 2.2
by Apple Product Security 21 Nov '08

21 Nov '08

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2008-11-20 iPhone OS 2.2 and iPhone OS for iPod touch 2.2 iPhone OS 2.2 and iPhone OS for iPod touch 2.2 is now available and addresses the following issues: CoreGraphics CVE-ID: CVE-2008-2321 Available for: iPhone OS 1.0 through 2.1, iPhone OS for iPod touch 1.1 through 2.1 Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: CoreGraphics contains memory corruption issues in the processing of arguments. Passing untrusted input to CoreGraphics via an application, such as a web browser, may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Michal Zalewski of Google for reporting this issue. ImageIO CVE-ID: CVE-2008-2327 Available for: iPhone OS 1.0 through 2.1, iPhone OS for iPod touch 1.1 through 2.1 Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution Description: Multiple uninitialized memory access issues exist in libTIFF's handling of LZW-encoded TIFF images. Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through proper memory initialization and additional validation of TIFF images. ImageIO CVE-ID: CVE-2008-1586 Available for: iPhone OS 1.0 through 2.1, iPhone OS for iPod touch 1.1 through 2.1 Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected device reset Description: A memory exhaustion issue exists in the handling of TIFF images. Viewing a maliciously crafted TIFF image may lead to an unexpected device reset. This update addresses the issue by limiting the amount of memory allocated to open a TIFF image. Credit to Sergio 'shadown' Alvarez of n.runs AG for reporting this issue. Networking CVE-ID: CVE-2008-4227 Available for: iPhone OS 1.0 through 2.1, iPhone OS for iPod touch 1.1 through 2.1 Impact: The encryption level for PPTP VPN connections may be lower than expected Description: The encryption level for PPTP VPN connections may revert to a previous lower setting. This update addresses the issue by properly setting the encryption preferences. Credit to Stephen Butler of the University of Illinois of Urbana-Champaign for reporting this issue. Office Viewer CVE-ID: CVE-2008-4211 Available for: iPhone OS 1.0 through 2.1, iPhone OS for iPod touch 1.1 through 2.1 Impact: Viewing a maliciously crafted Microsoft Excel file may lead to an unexpected application termination or arbitrary code execution Description: A signedness issue in Office Viewer's handling of columns in Microsoft Excel files may result in an out-of-bounds memory access. Viewing a maliciously crafted Microsoft Excel file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by ensuring that the affected index values are not negative. Credit: Apple. Passcode Lock CVE-ID: CVE-2008-4228 Available for: iPhone OS 1.0 through 2.1, iPhone OS for iPod touch 1.1 through 2.1 Impact: Emergency calls are not restricted to emergency numbers Description: iPhone provides the ability to make an emergency call when locked. Currently, an emergency call may be placed to any number. A person with physical access to an iPhone may take advantage of this feature to place arbitrary calls which are charged to the iPhone owner. This update addresses the issue by restricting emergency calls to a limited set of phone numbers. Passcode Lock CVE-ID: CVE-2008-4229 Available for: iPhone OS 1.0 through 2.1, iPhone OS for iPod touch 1.1 through 2.1 Impact: Restoring a device from backup may not re-enable the Passcode Lock Description: The Passcode Lock feature is designed to prevent applications from being launched unless the correct passcode is entered. A race condition in the handling of device settings may cause the Passcode Lock to be removed when the device is restored from backup. This may allow a person with physical access to the device to launch applications without the passcode. This update addresses the issue by improving the system's ability to recognize missing preferences. This issue does not affect systems prior to iPhone OS 2.0 or iPhone OS for iPod touch 2.0. Credit to Nolen Scaife for reporting this issue. Passcode Lock CVE-ID: CVE-2008-4230 Available for: iPhone OS 1.0 through 2.1, iPhone OS for iPod touch 1.1 through 2.1 Impact: Short Message Service (SMS) messages may be revealed before the passcode is entered Description: If an SMS message arrives while the emergency call screen is visible, the entire SMS message is displayed, even if the "Show SMS Preview" preference was set to "OFF". This update addresses the issue by, in this situation, displaying only a notification that a SMS message has arrived, and not its content. Safari CVE-ID: CVE-2008-4231 Available for: iPhone OS 1.0 through 2.1, iPhone OS for iPod touch 1.1 through 2.1 Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in the handling of HTML table elements. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved handling of HTML table elements. Credit to Haifei Li of Fortinet's FortiGuard Global Security Research Team for reporting this issue. Safari CVE-ID: CVE-2008-4232 Available for: iPhone OS 1.0 through 2.1, iPhone OS for iPod touch 1.1 through 2.1 Impact: Websites with embedded iframe elements may be vulnerable to user interface spoofing Description: Safari allows an iframe element to display content outside its boundaries, which may lead to user interface spoofing. This update addresses the issue by not allowing iframe elements to display content outside their boundaries. This issue does not affect systems prior to iPhone OS 2.0 or iPhone OS for iPod touch 2.0. Credit to John Resig of Mozilla Corporation for reporting this issue. Safari CVE-ID: CVE-2008-4233 Available for: iPhone OS 1.0 through 2.1, iPhone OS for iPod touch 1.1 through 2.1 Impact: Visiting a maliciously crafted website may initiate a phone call without user interaction Description: If an application is launched via Safari while a call approval dialog is shown, the call will be placed. This may allow a maliciously crafted website to initiate a phone call without user interaction. Additionally, under certain circumstances it may be possible for a maliciously crafted website to block the user's ability to cancel dialing for a short period of time. This update addresses the issue by properly dismissing Safari's call approval dialog when an application is being launched via Safari. Credit to Collin Mulliner of Fraunhofer SIT for reporting this issue. Webkit CVE-ID: CVE-2008-3644 Available for: iPhone OS 1.0 through 2.1, iPhone OS for iPod touch 1.1 through 2.1 Impact: Sensitive information may be disclosed to a person with physical access to an unlocked device Description: Disabling autocomplete on a form field may not prevent the data in the field from being stored in the browser page cache. This may lead to the disclosure of sensitive information to a person with physical access to an unlocked device. This update addresses the issue by properly clearing the form data. Credit to an anonymous researcher for reporting this issue. Installation note: This update is only available through iTunes, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes will automatically check Apple's update server on its weekly schedule. When an update is detected, it will download it. When the iPhone or iPod touch is docked, iTunes will present the user with the option to install the update. We recommend applying the update immediately if possible. Selecting "don't install" will present the option the next time you connect your iPhone or iPod touch. The automatic update process may take up to a week depending on the day that iTunes checks for updates. You may manually obtain the update via the "Check for Update" button within iTunes. After doing this, the update can be applied when your iPhone or iPod touch is docked to your computer. To check that the iPhone or iPod touch has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "2.2 (5G77)" or later Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQEcBAEBAgAGBQJJJheAAAoJEHkodeiKZIkBGUAH/REuNCXKJY9ft/GyAAQuhdJW 3z8MYEeaWnIGiJJ7YJmbahb5R/HcPEohVQqnmR0U91xlInF/ujS0Sg9ilEroRdRx OWgGjRLjEKD0h5dKHkn6JTVGeGFyLvUuStkAtzaUKgLWQXlIGRb0s6Z4zCHIbLUo lBYCzJ7BTM+NSyo5N+XVm5D+zJZ8Q1Oq1J6WSOSdeuoflWU6Oj75uXOrSA0HsNuQ 8xyoiUsCTbRUFigjuRhts+Oyh3AN1zabh4ms9eQCkRLiSCUNV7L3Yq9xk18GHGZ5 qQFP+VBztxnT7RAf0Yr8ubEBk9OzOyFpJSg3Tr2EGjP/+BCh+4O3f9Dx5CFuk8g= =UWvT -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2008-11-13 Safari 3.2
by Apple Product Security 13 Nov '08

13 Nov '08

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2008-11-13 Safari 3.2 Safari 3.2 is now available and addresses the following issues: Safari CVE-ID: CVE-2005-2096 Available for: Windows XP or Vista Impact: Multiple vulnerabilities in zlib 1.2.2 Description: Multiple vulnerabilities exist in zlib 1.2.2, the most serious of which may lead to a denial of service. This update addresses the issues by updating to zlib 1.2.3. These issues do not affect Mac OS X systems. Credit to Robbie Joosten of bioinformatics@school, and David Gunnells of the University of Alabama at Birmingham for reporting these issues. Safari CVE-ID: CVE-2008-1767 Available for: Windows XP or Vista Impact: Processing an XML document may lead to an unexpected application termination or arbitrary code execution Description: A heap buffer overflow issue exists in the libxslt library. Viewing a maliciously crafted HTML page may lead to an unexpected application termination or arbitrary code execution. Further information on the patch applied is available via http://xmlsoft.org/XSLT/ This issue does not affect Mac OS X systems that have applied Security Update 2008-007. Credit to Anthony de Almeida Lopes of Outpost24 AB, and Chris Evans of the Google Security Team for reporting this issue. Safari CVE-ID: CVE-2008-3623 Available for: Windows XP or Vista Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A heap buffer overflow exists in CoreGraphics' handling of color spaces. Viewing a maliciously crafted image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit: Apple. Safari CVE-ID: CVE-2008-2327 Available for: Windows XP or Vista Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution Description: Multiple uninitialized memory access issues exist in libTIFF's handling of LZW-encoded TIFF images. Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through proper memory initialization and additional validation of TIFF images. This issue is addressed in systems running Mac OS X v10.5.5 or later, and in Mac OS X v10.4.11 systems that have applied Security Update 2008-006. Credit: Apple. Safari CVE-ID: CVE-2008-2332 Available for: Windows XP or Vista Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exits in ImageIO's handling of TIFF images. Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved processing of TIFF images. This issue is addressed in systems running Mac OS X v10.5.5 or later, and in Mac OS X v10.4.11 systems that have applied Security Update 2008-006. Credit to Robert Swiecki of the Google Security Team for reporting this issue. Safari CVE-ID: CVE-2008-3608 Available for: Windows XP or Vista Impact: Viewing a large maliciously crafted JPEG image may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in ImageIO's handling of embedded ICC profiles in JPEG images. Viewing a large maliciously crafted JPEG image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved processing of ICC profiles. This issue is addressed in systems running Mac OS X v10.5.5 or later, and in Mac OS X v10.4.11 systems that have applied Security Update 2008-006. Credit: Apple. Safari CVE-ID: CVE-2008-3642 Available for: Windows XP or Vista Impact: Viewing a maliciously crafted image may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow exists in the handling of images with an embedded ICC profile. Opening a maliciously crafted image with an embedded ICC profile may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of ICC profiles in images. This issue does not affect Mac OS X systems that have applied Security Update 2008-007. Credit: Apple. Safari CVE-ID: CVE-2008-3644 Available for: Mac OS X v10.4.11, Mac OS X v10.5.5, Windows XP or Vista Impact: Sensitive information may be disclosed to a local console user Description: Disabling autocomplete on a form field may not prevent the data in the field from being stored in the browser page cache. This may lead to the disclosure of sensitive information to a local user. This update addresses the issue by properly clearing the form data. Credit to an anonymous researcher for reporting this issue. WebKit CVE-ID: CVE-2008-2303 Available for: Mac OS X v10.4.11, Mac OS X v10.5.5, Windows XP or Vista Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A signedness issue in Safari's handling of JavaScript array indices may result in an out-of-bounds memory access. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of JavaScript array indices. Credit to SkyLined of Google for reporting this issue. WebKit CVE-ID: CVE-2008-2317 Available for: Mac OS X v10.4.11, Mac OS X v10.5.5, Windows XP or Vista Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in WebCore's handling of style sheet elements. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved garbage collection. Credit to an anonymous researcher working with the TippingPoint Zero Day Initiative for reporting this issue. WebKit CVE-ID: CVE-2008-4216 Available for: Mac OS X v10.4.11, Mac OS X v10.5.5, Windows XP or Vista Impact: Visiting a maliciously crafted website may lead to the disclosure of sensitive information Description: WebKit's plug-in interface does not block plug-ins from launching local URLs. Visiting a maliciously crafted website may allow a remote attacker to launch local files in Safari, which may lead to the disclosure of sensitive information. This update addresses the issue by restricting the types of URLs that may be launched via the plug-in interface. Credit to Billy Rios of Microsoft, and Nitesh Dhanjani of Ernst & Young for reporting this issue. Safari 3.2 is available via the Apple Software Update application, or Apple's Safari download site at: http://www.apple.com/safari/download/ Safari for Mac OS X v10.5.5 The download file is named: "Safari3.2Leo.dmg" Its SHA-1 digest is: 540668ffd5e3a4727720b8687e05f7c43908424a Safari for Mac OS X v10.4.11 The download file is named: "Safari3.2Ti.dmg" Its SHA-1 digest is: 463619e89f421eceaed32ea5e9a48891ad8fdb4e Safari for Windows XP or Vista The download file is named: "SafariSetup.exe" Its SHA-1 digest is: 38be6fb56f20de8c312956cd0df40d39584bce53 Safari+QuickTime for Windows XP or Vista The file is named: "SafariQuickTimeSetup.exe" Its SHA-1 digest is: 6da9ca61479ce287cea476617253f6a93cbc6aa8 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQEcBAEBAgAGBQJJHGGCAAoJEHkodeiKZIkBe7EH/iPYgXS6L/Lz614W00Zo5f8O CuyUiK7HZYoXaFjSvB/aYBkjHtrVKYZFGF2WLmgxFig65TchCCw5PoenU5rqUaWd pzytc1dyLxBOkqisky49SdzTsTkNT3jQWjJf9WJwMoD+s4btMVgHLDLI3WGfw3ct RcVIVrjDdgMsJ2ERnZ/R6Dxx9SB3RC3DBWCHaAgZawR8CeZdnj60M81BaDZ6Oma5 o6aNr7rUg0MfnEuqypxGVLwEHGHe9dUfs07sS/pTXvkk/7+CKNoTxe/8cOK3kuFZ RFV7rSJOWfUiG608FBvvbRO1z+4z215HGXBSPIZ5/wWThRczD3kcjWN8wv8FA/I= =klZG -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2008-11-10 iLife Support 8.3.1
by Apple Product Security 10 Nov '08

10 Nov '08

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2008-11-10 iLife Support 8.3.1 iLife Support 8.3.1 is now available and addresses the following security issues: ImageIO CVE-ID: CVE-2008-2327 Available for: iLife 8.0 or Aperture 2, on Mac OS v10.4.9 through v10.4.11 Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution Description: Multiple uninitialized memory access issues exist in libTIFF's handling of LZW-encoded TIFF images. Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through proper memory initialization and additional validation of TIFF images. These issues are already addressed in systems running Mac OS X v10.5.5. Credit: Apple. ImageIO CVE-ID: CVE-2008-2332 Available for: iLife 8.0 or Aperture 2, on Mac OS v10.4.9 through v10.4.11 Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exits in the handling of TIFF images. Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved processing of TIFF images. This issue is already addressed in systems running Mac OS X v10.5.5. Credit to Robert Swiecki of Google Security Team for reporting this issue. ImageIO CVE-ID: CVE-2008-3608 Available for: iLife 8.0 or Aperture 2, on Mac OS v10.4.9 through v10.4.11 Impact: Viewing a large maliciously crafted JPEG image may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in ImageIO's handling of embedded ICC profiles in JPEG images. Viewing a large maliciously crafted JPEG image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved processing of ICC profiles. This issue is already addressed in systems running Mac OS X v10.5.5. Credit: Apple. iLife Support 8.3.1 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ The download file is named: "iLifeSupport.dmg" Its SHA-1 digest is: 2911f4608c3c69eb8056a5bf6d5186a4f403517d Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQEcBAEBAgAGBQJJGJr6AAoJEHkodeiKZIkBPZcIAJIzbTPZeVCbe4wUKuOu26mW ZlylDN5w109B12PWuwnJqbbGmiPIvf7Sp+ydEtTcxskeie8Vg/9Z+k+Z/LLmUsob 6Y8TGSQL9InCH1BxQqrhYcP7CJFhXwpnu4zqOYr5fzQURLyTqHoASQmm0SQb62lG +xnEgMBcX7T82iqqnU08e79hN1VEYQf1Q5BQg+6urgDu5dbUifsHM/Etw8p8Wjle c3n3kh/9wwvWExSD1E7ffrWUHdj79cZEw7RixomHK3KyoVt6VIg9mN1K4W51tcWH V+IEBUuQfz40iedmtq1RsTISeA2+7AirS2Yr2p8ozcP46rNKLk0qAVje/NImfBY= =/hZ6 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0